Skip to main content

TLS configuration

[tls]​

The certificate, private key and handshake policy every TLS-terminating listener shares. Read only when some listener terminates TLS.
[tls]
# certificate = "/etc/andromeda/tls/tls.crt"
# private_key = "/etc/andromeda/tls/tls.key"
minimum_protocol_version = "tls1.2"
handshake_timeout = "10s"
reload_settle_after = "2s"

tls.certificate​

pathreloads live

The PEM certificate chain the broker presents, leaf first. Left out, no listener can terminate TLS. The file is reloaded when it changes.

Default
Not set. Example: "/etc/andromeda/tls/tls.crt"
Also required
Environment variable
ANDROMEDA__TLS__CERTIFICATE

tls.private_key​

pathreloads live

The PEM private key of the leaf certificate, as PKCS#8, SEC1 or PKCS#1. Left out, no listener can terminate TLS. The file is reloaded when it changes.

Default
Not set. Example: "/etc/andromeda/tls/tls.key"
Also required
Environment variable
ANDROMEDA__TLS__PRIVATE_KEY

tls.minimum_protocol_version​

stringrestart to apply

The oldest TLS version a TCP connection may negotiate. HTTP/3 always uses TLS 1.3.

Default
"tls1.2"
Allowed values
"tls1.2"Accepts TLS 1.2 and TLS 1.3. NGSI-LD requires TLS 1.2 support.
"tls1.3"Accepts TLS 1.3 only, for a deployment whose clients all speak it.
Environment variable
ANDROMEDA__TLS__MINIMUM_PROTOCOL_VERSION

tls.handshake_timeout​

non-zero durationrestart to apply

How long a TCP client may take to finish its TLS handshake before the connection is dropped.

Default
"10s"
Must be
0 < handshake_timeout
Environment variable
ANDROMEDA__TLS__HANDSHAKE_TIMEOUT

tls.reload_settle_after​

durationrestart to apply

How long the certificate files must stay unchanged after an edit before the broker loads them again, so a certificate and key replaced one after the other load together.

Default
"2s"
Environment variable
ANDROMEDA__TLS__RELOAD_SETTLE_AFTER

[tls.client_authentication]​

Client certificate authentication (mutual TLS).
[tls.client_authentication]
mode = "disabled"
# ca = "/etc/andromeda/tls/clients.pem"

tls.client_authentication.mode​

stringrestart to apply

Whether clients are asked for a certificate, and whether one is required.

Default
"disabled"
Allowed values
"disabled"Asks for no client certificate. Authentication, if any, happens above TLS.
"optional"Verifies a client certificate when the client sends one and still serves a client without. A certificate from an issuer outside tls.client_authentication.ca fails the handshake.
"required"Serves only clients that present a certificate chaining to tls.client_authentication.ca.
Also required
Environment variable
ANDROMEDA__TLS__CLIENT_AUTHENTICATION__MODE

tls.client_authentication.ca​

pathreloads live

The PEM bundle of the CAs client certificates must chain to. Left out, no client certificate can be verified.

Default
Not set. Example: "/etc/andromeda/tls/clients.pem"
Also required
Environment variable
ANDROMEDA__TLS__CLIENT_AUTHENTICATION__CA